fix: do not inject conjur-secrets VolumeMount for k8s_secrets destina…

[mahender7090]

fix: do not inject conjur-secrets VolumeMount for k8s_secrets destination

When secrets-destination is k8s_secrets, the conjur-secrets volume is never created (only created for
file destination in getSPVolumes). The app container VolumeMount injection in server.go was unconditionally
adding conjur-secrets regardless of the destination, causing Kubernetes to reject the pod because a referenced
volume does not exist.

Fix: gate the conjur-secrets VolumeMount on secretsDestination == "file", matching the existing condition in
getSPVolumes(). Add test cases and fixtures for k8s_secrets sidecar and init modes to prevent regression.

Desired Outcome

When using the secrets-provider inject type with conjur.org/secrets-destination: k8s_secrets, the sidecar
injector should only inject the conjur-status VolumeMount into application containers. The conjur-secrets
VolumeMount must not be injected because no backing volume is created for the k8s_secrets destination,
and Kubernetes will reject the pod if a VolumeMount references a non-existent volume.

Implemented Changes

What's changed?

• pkg/inject/server.go: In the secrets-provider case of HandleAdmissionRequest, the
  ContainerVolumeMounts loop now conditionally appends the conjur-secrets VolumeMount only when
  secretsDestination == "file". Previously, both conjur-status and conjur-secrets were always appended,
  regardless of the destination.

Why were these changes made?

• getSPVolumes() in secrets-provider.go already correctly gates conjur-secrets volume creation on
  secretsDest == "file". The VolumeMount injection in server.go was inconsistent with this, creating a
  mismatch that caused Kubernetes to reject pods using k8s_secrets.

New test fixtures (4 files):

File	Purpose
testdata/secrets-provider-k8s-annotated-pod.json	Input pod annotated with secrets-destination: k8s_secrets, sidecar mode
testdata/secrets-provider-k8s-mutated-pod.json	Expected output — only conjur-status mount, no conjur-secrets
testdata/secrets-provider-k8s-init-annotated-pod.json	Input pod annotated with secrets-destination: k8s_secrets, init mode
testdata/secrets-provider-k8s-init-mutated-pod.json	Expected output — only conjur-status mount, no conjur-secrets

New test cases in secrets-provider_test.go:

• SecretsProvider k8s_secrets sidecar - no conjur-secrets volume injected
• SecretsProvider k8s_secrets init - no conjur-secrets volume injected

The three existing file-destination test cases remain unchanged, verifying no regression for the file-based path.

How to review:

1. Check the one-line change in server.go — the conjur-secrets VolumeMount append is now inside an
   if secretsDestination == "file" block.
2. Review the four new fixture files to confirm the expected k8s_secrets pod structure (no conjur-secrets
   volume or mount).
3. Run the test suite: go test ./pkg/inject/...

Connected Issue/Story

Resolves #[relevant GitHub issue]

CyberArk internal issue ID: [insert issue ID]

Definition of Done

Changelog

• The CHANGELOG has been updated, or
• This PR does not include user-facing changes and doesn't require a CHANGELOG update

Test coverage

• This PR includes new unit and integration tests to go with the code changes, or
• The changes in this PR do not require tests

Documentation

• Docs (e.g. READMEs) were updated in this PR
• A follow-up issue to update official docs has been filed here: [insert issue ID]
• This PR does not require updating any documentation

Behavior

• This PR changes product behavior and has been reviewed by a PO, or
• These changes are part of a larger initiative that will be reviewed later, or
• No behavior was changed with this PR

Security

• Security architect has reviewed the changes in this PR,
• These changes are part of a larger initiative with a separate security review, or
• There are no security aspects to these changes